Issue
-
After installing the Audit Trail plugin, an "operation X" does not appear in the logs.
Resolution
First, the Audit Trail plugin needs to be configured in Manage Jenkins > System > Audit Trail section and at least one Logger type needs to be added. The location of the Audit Trail logs depends on the Logger type.
Once the plugin is configured, your instance keeps an audit trail of particular operations which the particular request matches with one of the following patterns. At the moment of writing this articles the patterns are:
-
configSubmit -
doDelete -
postBuildResult -
enable -
disable -
cancelQueue -
stop -
toggleLogKeep -
doWipeOutWorkspace -
createItem -
createView -
toggleOffline -
cancelQuietDown -
quietDown -
restart -
exit -
safeExit
Other patterns not set in the plugin default configuration could be of interest, such as updateSubmit to display credential related changes in the audit logs.
Also, it receives notifications about builds thanks to AuditTrailRunListener extends RunListener.
Examples of Jenkins operation being audited
-
Run a build from testJob by testUser
yyyy-MM-dd HH:mm:ss:SSS - job/testJob/ #<BUILD_NUMBER> Started by user testUser@mail.com
-
Creating a new job (testUser) or editing an existing one (testUser) have the same output
yyyy-MM-dd HH:mm:ss:SSS - /job/testJob/configSubmit by testUser
-
Updating the email of the logged user
yyyy-MM-dd HH:mm:ss:SSS - /me/configSubmit by testUser
-
Adding new logger to Audit Trail configuration
yyyy-MM-dd HH:mm:ss:SSS - /configSubmit by admin
Examples of Jenkins operation NOT being audited
-
Creating new users (sign up) in Jenkins owns Database see JENKINS-27028
Adding an operation
Audit trail plugin allows to specify custom patterns to log. You can find the pattern to log by looking which endpoint Jenkins is making a POST to when you do an operation.
As an example, when you uninstall a plugin, Jenkins is making a POST request to doUninstall so you can simply add this pattern to the Url Patterns to Log in advanced section of the Audit Trail configuration.
Once done, uninstalling a plugin will display:
May 20, 2019 10:32:28,608 AM /pluginManager/plugin/<plugin_name>/doUninstall by admin
In case you have trouble finding the endpoint to log, please contact CloudBees Support for help.